Last year, a thriving medical practice in Northern Virginia closed after 15 years because a ransomware attack encrypted its patient records. They carried General Liability and Professional Liability insurance but lacked Cyber Liability coverage. The resulting $850,000 in recovery costs, regulatory fines, and legal fees wiped out their reserves.
This is not an isolated case. Recent industry data show that over 40% of small to mid-sized businesses that suffer a major uninsured loss close within six months. Too many business owners assume they’re fully covered—only to discover dangerous coverage gaps when it’s too late.
After helping hundreds of businesses across Virginia, Maryland, DC, and beyond for more than 34 years, we’ve identified the most common—and costliest—business insurance gaps that will put companies at risk in 2026. In the sections below you’ll learn which policies to check, which exposures are often missed, and the practical steps owners and their agent or broker should take to close those gaps.
Gap #1: Cyber Liability Coverage (The Gap That's Growing Fastest)
The Risk: Cyberattacks are now a core business risk—not just a Fortune 500 problem. In 2024, industry reporting showed roughly 73% of small businesses experienced at least one cyber incident. Ransomware, data breaches, and business email compromise can generate direct and indirect costs ranging from about $50,000 to several million dollars when you include:
- Breach notification and regulatory response costs
- Credit monitoring or identity protection for affected customers
- Legal defense, settlement expenses, and fines
- Business interruption losses while systems are offline
- Ransom payments or professional data recovery services
- Public relations and reputation repair
First-party vs. Third-party: First-party coverage helps pay your own recovery costs (forensic investigators, data restoration, lost income); third-party coverage protects you when customers or partners sue over a breach.
Who Needs It Most:
- Law Firms: You hold privileged client data that attackers prize.
- Medical Practices & Laboratories: HIPAA breaches can lead to hefty penalties and remediation costs.
- IT Firms: Ironically, tech providers often overlook their own cyber exposure.
- Any business storing customer data, credit card details, or sensitive information.
Real example: An accounting firm we reviewed lost funds and client records after a business email compromise—recovery and notification costs exceeded their cyber policy sub-limit, leaving significant out-of-pocket expenses.
The Fix: Buy a comprehensive Cyber Liability policy that includes both first-party and third-party coverage and confirms social engineering/funds-transfer coverage. Ask your agent or broker to show specific sub-limits and exclusions, and verify whether your policy pays for business interruption and reputational services.
Quick takeaway: If you collect or store data, get cyber coverage—and confirm social engineering limits with your broker to help cover wire-fraud exposure.
Gap #2: Employment Practices Liability Insurance (EPLI)
The Risk: Employment-related claims are rising and can be expensive. Average settlements or judgments commonly fall between $40,000 and $200,000, and even a successful defense can cost more than $75,000. Typical claims include:
- Wrongful termination
- Discrimination or harassment allegations
- Retaliation claims
- Wage-and-hour disputes
- Failure to promote
The Reality Check: Standard General Liability policies generally exclude employment-related claims, so many owners only discover this coverage gap after a lawsuit is filed.
What EPLI Typically Covers:
- Defense costs and settlements for employee claims
- Harassment and discrimination allegations (including third-party claims)
- Wrongful termination and retaliation suits
- Employment-related regulatory defense
Who Needs It: Any business with employees—even small firms with three staff—nonprofits with volunteer boards, growing companies adding headcount, and industries with high turnover should carry EPLI.
Small-employer example: A three-person retail shop faced a discrimination complaint after a termination; defense costs exceeded the owner’s expectations and forced operational cutbacks.
The Fix: Add EPLI as an endorsement or buy it standalone. Make sure the policy includes defense costs outside the limit and covers third-party claims. Pair EPLI with clear HR policies and documentation—before you meet your agent or broker, gather personnel files, performance reviews, and termination records to speed the audit and help price coverage accurately.
Gap #3: Professional Liability/Errors & Omissions Coverage
The Risk: Professional liability (Errors & Omissions) exposure reaches far beyond doctors and lawyers. If your business provides advice, design, specifications, or specialized services, a client claim for negligence, mistake, or failure to deliver can trigger costly defense and settlement expenses.
Who this affects:
- Engineering Firms: Design errors or faulty recommendations can cause property damage or injury.
- IT Consultants: A misconfigured system or failed security implementation can expose client data.
- General Contractors: Design-build services can create professional exposure not covered by General Liability.
- Marketing Agencies: Allegations like missed deliverables, copyright infringement, or confidentiality breaches.
- Home Health Care Providers: Medical mistakes or documentation errors that harm patients.
Claims-made vs. occurrence — why it matters: Most professional liability policies are claims-made, meaning coverage applies only if the policy in force at the time the claim is made (and usually when the alleged error occurred) is active. If you cancel or switch carriers without buying "tail" (extended reporting) coverage, past work can become uninsured.
Real-world example: A consulting firm completed a project, switched carriers two years later, and was sued over an alleged design flaw. Because they lacked tail coverage, the new insurer denied the claim and the firm faced large out-of-pocket costs.
The Fix: Maintain continuous professional liability coverage. If you change carriers, negotiate tail coverage or prior acts coverage. Size your limits to match contract requirements and project exposure—many clients now request $2 million limits or higher. Ask your agent or broker to:
- Confirm whether your policy is claims-made or occurrence
- Explain tail vs. nose coverage options
- Recommend limits based on contract and project size
Gap #4: Business Interruption with Adequate Limits
The Risk: Many businesses include Business Interruption as part of their commercial property policy but underestimate the limits they actually need. Business Interruption is designed to replace lost income and cover ongoing expenses when a covered property loss prevents you from operating—if your limit is too low, insurance won't prevent a cash-flow crisis.
The Miscalculation: Owners often set BI limits based only on recent revenue. A realistic calculation should add fixed costs and extra operating expenses and account for seasonality and growth. Consider these often-missed items:
- Seasonal fluctuations—being closed during your peak season multiplies lost income
- Growth trajectory—higher revenue today than last year changes your exposure
- Continuing fixed expenses—payroll, rent, loan payments that don’t stop
- Extra expenses—temporary location, expedited shipping, or overtime to restart operations
- Extended repair timelines—supply-chain delays and contractor backlogs can double rebuild time
Quick sizing formula: (Average monthly revenue × estimated months of downtime) + monthly fixed expenses × months + estimated extra expenses = target Business Interruption limit. Run the math for 12 and 18 months to see which makes sense for your business.
Real-World Example: A restaurant with $1.2 million in annual revenue carried only $600,000 in Business Interruption coverage. After a kitchen fire closed them for nine months, lost peak-season sales, ongoing payroll, rent, and reopening costs pushed the total loss past $1.4 million.
Extended and Contingent Coverage: Ask about Extended Business Interruption (covers the slow return of customers after you reopen) and Contingent Business Interruption (covers losses when a key supplier or customer suffers property damage). These add-ons can help cover losses your standard commercial property insurance won’t.
The Fix: Work with your agent or broker to model realistic downtime scenarios and set BI limits for 12–18 months (or longer if your industry or location suggests). Document fixed costs, list critical suppliers, and identify contingency plans—this will help ensure the policy limits actually help cover your recovery.
Gap #5: Equipment Breakdown Coverage
The Risk: Standard Commercial Property policies usually cover fire, wind, and named perils—but mechanical breakdowns, electrical failures, and operator error are often excluded. When mission-critical equipment fails (HVAC, commercial refrigeration, servers, medical devices, or production machinery), the direct repair cost is only part of the damage; the business impact can be severe.
Hidden Exposure Areas:
- Medical Practices: Imaging, sterilization, and diagnostic equipment—often high-value and mission-critical.
- Restaurants: Walk-in freezers or refrigeration failures can ruin inventory overnight.
- Manufacturing: Production-line downtime from a single component failure can halt output.
- Data Centers/IT Companies: Server or power distribution failures cause cascading service interruptions.
The Cost Reality: A relatively small mechanical failure (a $30,000 compressor) can trigger spoilage, lost contracts, regulatory impacts, and expedited repair costs—pushing total losses well into the hundreds of thousands (examples have exceeded $500,000).
Assets to schedule (quick checklist):
- List high-value equipment with serial numbers and ages
- Record replacement cost estimates and criticality (how soon must it be back online?)
- Keep maintenance logs and service contracts to demonstrate risk management
The Fix: Add Equipment Breakdown (Boiler & Machinery) coverage to your property program. This coverage typically helps pay for repair or replacement, business income loss during downtime, spoilage, and expediting expenses to restore operations faster. Ask your agent or broker to confirm sub-limits for spoilage and to ensure the policy covers modern technology and service interruption—documentation of regular maintenance can also reduce friction on claims and sometimes lower premiums.
Gap #6: Umbrella/Excess Liability with Insufficient Limits
The Risk: Standard General Liability limits (often $1–2 million) and Auto Liability (commonly $1 million) can be exhausted by a single catastrophic claim. When that happens, your business—and potentially your personal assets—can be exposed to judgments that far exceed primary limits.
When you're especially vulnerable:
- Trucking companies: Catastrophic accidents can generate multi‑million dollar claims.
- Contractors: Job-site incidents involving multiple parties often lead to large settlements.
- Nightclubs & hospitality: Assaults, liquor-liability claims, and large premises exposures.
- Any high-foot-traffic business: Retail, events, and venues where severe injuries could occur.
Asset protection reality: If you own real estate, have significant accounts receivable, leases, or personal net worth tied to the business, you need higher limits—plaintiffs' attorneys investigate assets before filing and will seek maximum recoveries.
Quick decision checklist:
- Do you own your building or valuable equipment?
- Are accounts receivable or contract values large?
- Do you operate vehicles (auto liability exposure)?
- Would a single judgment threaten business survival or personal bankruptcy?
The Fix: Purchase a commercial umbrella/excess policy to add $1–5 million (or more) above your underlying liability limits. Ensure the umbrella "follows form" so excess limits respond consistently with your primary policies. Typical market entry pricing for the first $1M varies—work with your agent or broker to get accurate quotes. Suggested baseline limits by industry: retail/office 2–5M, contractors 3–5M, trucking 5–10M+
Gap #7: Cyber Coverage for Social Engineering/Funds Transfer Fraud
The Risk: Even with Cyber Liability in place, many policies exclude or sublimit losses from social engineering and funds-transfer fraud. Scammers impersonate executives, vendors, or clients to trick employees into wiring money or changing banking details—and those schemes are increasingly sophisticated.
How it happens:
- A controller receives an email that appears to be from the CEO urgently requesting a wire transfer.
- An accounts-payable clerk gets a convincing message from a "vendor" with updated banking instructions.
- A real-estate closing is hijacked when altered wiring instructions are sent to the title company.
The damage: Average losses commonly range from about $50,000 to $300,000 and are often unrecoverable. Standard Crime policies may deny coverage if an employee voluntarily initiated the transfer, so relying on traditional coverage can leave a serious gap.
3-step prevention (document this for your insurer):
- Dual authorization for all wire transfers over a threshold.
- Out-of-band verification—call a known number (not one supplied in the email) to confirm changes.
- Bank confirmation procedures and written change-request forms saved in records.
The Fix: Confirm your Cyber Liability or Crime policy explicitly includes Social Engineering/Funds Transfer coverage with adequate limits (consider at least $250,000–$500,000). Work with your agent or broker to identify sub-limits, waiting periods, and any exclusions, and document internal controls so insurers see you’re actively reducing risk.
Industry-Specific Critical Gaps
For Law Firms:
Must-check coverages: Professional liability for legal services, Cyber coverage for client data breaches, and Trust Account coverage for IOLTA accounts (many policies exclude trust accounts). Confirm employee-theft and fidelity limits to protect against internal fraud.
For Medical Practices & Labs:
Must-check coverages: Medical professional liability, HIPAA-specific breach response coverage, Cyber Liability with robust first‑party limits, and Employment Practices coverage—healthcare frequently faces employment claims and regulatory remediation costs.
For General Contractors:
Must-check coverages: General Liability isn’t enough for some renovation work—add Pollution Liability (mold, asbestos, lead disturbance), appropriate contractor professional liability for design-build work, and inland marine for tools/equipment in transit.
For Nonprofits:
Must-check coverages: Directors & Officers (D&O) liability to attract and protect volunteer board members, and Employee Dishonesty/Crime coverage—nonprofits are frequent targets for embezzlement.
For Trucking Companies:
Must-check coverages: Adequate Auto Liability limits, Cargo coverage, Non‑Trucking Liability (bobtail) for personal use exposures, and Contingent Liability to protect if owner-operators’ insurance is insufficient.
For Wineries & Breweries:
Must-check coverages: Product Recall coverage (to pay for recalls, destroyed inventory, and lost sales during the recall period), Product Liability, and adequate property coverage for fermenting/aging inventory that may be temperature-sensitive.
The 2026 Insurance Coverage Audit Checklist
Use this checklist to quickly identify coverage gaps and prioritize your insurance needs.
Essential Coverages (score these first):
- [ ] General Liability Insurance (minimum $1–2 million)
- [ ] Commercial Property Insurance (actual replacement cost, not depreciation)
- [ ] Business Interruption Coverage (model for 12–18 months of income)
- [ ] Workers’ Compensation (if you have employees)
- [ ] Commercial Auto (for any vehicles used for business)
- [ ] Professional Liability / E&O (if you provide services, advice, or designs)
- [ ] Cyber Liability Insurance (consider a minimum $1 million; verify social-engineering sub-limits)
- [ ] Employment Practices Liability Insurance (EPLI)
Often Overlooked but Critical:
- [ ] Equipment Breakdown / Boiler & Machinery Coverage
- [ ] Commercial Umbrella / Excess Policy (typically adds $2–5M or more)
- [ ] Social Engineering / Funds Transfer Fraud coverage
- [ ] Business Interruption – Contingent (supplier/customer disruption)
- [ ] Hired & Non‑Owned Auto Liability (if employees use personal vehicles for work)
- [ ] Employee Dishonesty / Crime Coverage
Industry-Specific Additions (check applicable items):
- [ ] Pollution Liability (contractors, manufacturers)
- [ ] Liquor Liability (restaurants, nightclubs, event venues)
- [ ] Directors & Officers (D&O) Liability (nonprofits, larger businesses)
- [ ] Product Recall (food/beverage, manufacturers)
- [ ] Cargo Coverage (trucking, distribution)
- [ ] Medical Professional Liability (healthcare providers)
- [ ] Inland Marine (tools, equipment, goods in transit)
Review your existing policies for:
- [ ] Adequate limits (don’t assume minimums are sufficient)
- [ ] Actual replacement cost vs. depreciation on property values
- [ ] Exclusions that might interrupt operations or claims
- [ ] Certificate holders and additional-insured endorsements required by contracts
- [ ] Policy expiration dates—are renewals staggered or aligned?
- [ ] Deductibles you can realistically afford in a loss
Quick audit tips: Gather declarations pages, schedules, and endorsements first. Score each unchecked essential item as a high-priority gap. If you find 2+ essential items missing, treat this as a critical coverage gap and contact your agent or broker to model scenarios (e.g., BI for 12 vs. 18 months, cyber limits, umbrella sizing). For ease, consider downloading a printable PDF checklist and bringing it to your insurance review.
What to Do Next
Insurance gaps rarely announce themselves. The medical practice in our opening example operated for 15 years without a claim—until one ransomware event ended everything. Don’t let that be your business.
Take these three steps this week:
- Schedule a comprehensive insurance review. Don’t wait for renewal season. Your business, risks, and contracts likely changed—so should your insurance coverage.
- Gather your current policies. Collect declarations pages, endorsements, and schedules so an audit can identify coverage gaps and mismatches between your operations and your policies.
- Talk to a specialized commercial agent or broker. Brokers who work with multiple carriers can match your industry exposures to the right policies and limits—especially for complex needs like cyber, professional liability, or commercial property.
At TransAtlantic Commercial Insurance, we’ve spent 34 years helping businesses across Virginia, Maryland, DC, Delaware, North Carolina, Florida, South Carolina, Pennsylvania, and Georgia identify and close dangerous coverage gaps. We specialize in tailored commercial insurance for law firms, medical practices, contractors, nonprofits, trucking companies, and many other industries.
We don’t believe in one-size-fits-all insurance. We focus on education, transparency, and building insurance coverage that actually helps cover the risks you face.
Don’t wait for a claim to discover your gaps. For a complimentary, no-pressure insurance audit, call us at 703-674-0299 or visit TCIIns.net. We’ll review your current coverage, identify potential exposures (property insurance, professional liability, workers’ compensation, cyber limits, and more), and give straightforward recommendations you can act on.
Because the best time to fix a coverage gap is before you need the coverage.
Trans-Atlantic Commercial Insurance, LLC is a licensed insurance broker serving businesses in Virginia, Maryland, Washington DC, Delaware, North Carolina, Florida, South Carolina, Pennsylvania & Georgia. We specialize in complex commercial insurance solutions for law firms, medical practices, contractors, nonprofits, trucking companies, and dozens of other industries. Contact us at 703-674-0299 or visit TCIIns.net.